Descript

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:42 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Descript connector, but its setup instructions include unverified remote installer commands that could execute arbitrary code.

Install only if you are comfortable with the OOMOL oo CLI and review or install it through a safer verified method first. Do not let an agent run the documented remote installer one-liners automatically; approve Descript write or publish actions only after checking the exact payload and target.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote Shell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction pipes a remotely downloaded script directly into Bash. The script is neither version-pinned nor verified using a cryptographic signature or checksum. Its effective contents may therefore change after the Skill has been reviewed. Although the URL uses HTTPS and belongs to a domain associated with the declared OOMOL integration, TLS does not establish that every future version of the hosted script is safe. Compromise of the distribution server, publishing process, DNS/TLS trust chain, or OOMOL account controlling the artifact could turn this command into an arbitrary-code execution channel. The installation behavior also exceeds the minimum privileges required for ordinary Descript operations. Once the CLI is installed, the declared functionality only requires commands matching `oo *`; routine connector use does not require downloading and executing mutable shell code. The Skill limits installation to a command-not-found fallback, which reduces exposure but does not address payload integrity. ### Attack Path 1. An attacker compromises the installer hosting infrastructure or its release pipeline. 2. The attacker replaces `https://cli.oomol.com/install.sh` with a malicious or backdoored script. 3. A user encounters the documented `oo: command not found` condition and follows the installation instruction. 4. `curl` retrieves the current attacker-controlled response. 5. Bash executes the response immediately, without local inspection or integrity verification. 6. The payload performs arbitrary operations available to the invoking account, potentially including data theft, modification of user files, installation of persistence, ...[truncated 593 chars]
• Remediation: ## Remediation Suggestions - Replace the piped installer with a version-pinned package or immutable release artifact. - Download the artifact to a local file rather than piping it directly into a shell. - Publish and verify a cryptographic signature or trusted checksum before execution. - Permit users to inspect the downloaded script before deciding whether to execute it. - Require explicit user approval before running any installer. - Prefer an operating-system package manager with signed metadata and pinned package versions. - Document the expected installer hash, publisher identity, destination files, and required permissions. - Run installation with ordinary user privileges and avoid requesting administrator privileges unless demonstrably necessary.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:67
• Finding: Unverified Remote PowerShell Script Execution## Vulnerability Details **File Location**: `SKILL.md`, line 67 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows installation instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and passes the response directly to `Invoke-Expression` (`iex`). This causes the downloaded content to execute immediately without version pinning, signature validation, checksum verification, or an opportunity for local inspection. HTTPS protects transport confidentiality and integrity under normal conditions but does not make the remote payload immutable or independently attest to its publisher. A compromised hosting service, release process, DNS/TLS trust chain, or artifact-publishing account could alter the script after this Skill has passed review. This installation channel is not required for routine Descript connector actions once the `oo` CLI is available. Consequently, remote script execution should not be part of normal operation and should be isolated behind explicit user consent and robust artifact verification. ### Attack Path 1. An attacker gains control over the hosted PowerShell installer or the infrastructure that serves it. 2. The attacker modifies `install.ps1` to contain malicious PowerShell commands. 3. A Windows user receives an `oo: command not found` error and follows the documented fallback. 4. `irm` downloads the modified response. 5. `iex` evaluates the response directly in the active PowerShell session. 6. The malicious commands execute with the current process token and can access or modify resources available to that Windows account. ### Impact Assessment Exploitation permits arbitrary PowerShell execution with the invoking user's privileges. Potential consequences include access to user-readable f ...[truncated 427 chars]
• Remediation: ## Remediation Suggestions - Distribute a version-pinned, Authenticode-signed PowerShell script or signed installer package. - Download the artifact to disk and validate its signer and cryptographic hash before execution. - Do not use `Invoke-Expression` for remotely retrieved content. - Display the artifact source, version, signer, hash, and intended system changes to the user. - Require explicit user approval before executing the verified installer. - Prefer a trusted Windows package manager or signed MSI/MSIX distribution with immutable release versions. - Execute with standard-user permissions unless administrative access is strictly required and separately approved.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 98% confidence
• Finding: The skill instructs the agent to execute a remote installation script via `curl ... | bash`, which is a classic unsafe pattern because it downloads code from the network and immediately executes it without verification. In an agent context this is more dangerous because a missing local dependency can trigger the fallback path, turning a normal Descript task into arbitrary shell execution sourced from an external server.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description says to use this skill for "ANY Descript request" and "Whenever a task involves Descript," which is a very broad activation condition that could overlap with many ordinary requests mentioning Descript. The file does not provide negative examples or clear boundaries for when this skill should not be invoked.

Static analysis

No suspicious patterns detected.